Claudexor
A local-first control plane that puts the coding agents you already pay for — Claude Code, Codex, Cursor, OpenCode — behind one interface with quota-aware account rotation, shared thread context, and cross-model review.
- Source repo
- razzant/claudexor
- Stars
- ★ 518
- Last updated
- 1d ago
- License
- MIT
- Primary language
- TypeScript
- FA score
- 76/100 · Good
At a glance
- How it runs
- Works with
- Portable with changesCodex · Claude CodeOpenAI API · Claude API (Partial support)
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A developer holding several Claude or Codex subscriptions who wants automatic switching to the account with headroom when 5-hour/7-day quota windows exhaust, instead of manual account swaps.
- Not a fit if
- Users without paid Claude/Codex/Cursor subscriptions or API keys
- Windows users needing full support or a desktop app
- Teams wanting a zero-learning-curve tool with no CLI relearning
- Source review
- 76/100 · Good
What does this agent do, and when should you use it?
Claudexor (GitHub: razzant/claudexor, MIT licensed, currently v3.9.8) is a local-first control plane that runs Codex CLI, Claude Code, Cursor CLI, OpenCode, Antigravity CLI, and raw API adapters behind one typed interface. It solves problems the vendors don't ship: quota-aware rotation across multiple subscriptions (with live quota tracking and automatic account switch on typed vendor limits for Antigravity/Claude/Codex), shared thread context (read-only turns resume each vendor's native session; lane switches inject bounded continuation packets), and best-of-N races with cross-family independent reviewers and arbitration. Write turns land as inspectable patches, and every claim — cost, quota, web evidence, auth route — is a typed fact you can audit; unknown cost is never reported as $0. Everything runs on your machine, files are the source of truth, and there is no telemetry. The CLI/daemon ship via npm and the macOS desktop app ships as a signed, notarized DMG; the app is macOS-only while the CLI/daemon also run on Linux.
A managed daemon (Unix-socket command queue plus a loopback /v2 HTTP/SSE control API) drives multiple vendor coding CLIs. Core commands: claudexor ask (read-only Q&A; --deep-scan triggers a bounded multi-scout research sweep), claudexor plan (with --council drafting plans across N harnesses in parallel and merging into one unified plan), claudexor agent (write turns with --n N best-of-N races, --attempts repair loops, --until-clean, and --delegate, which injects a scoped MCP belt letting the harness spawn up to 8 isolated sub-runs), claudexor best-of, and claudexor inspect/apply/follow. At the account layer, claudexor profiles add/login/enable registers multiple named subscription bindings; unpinned runs route through a quota-aware pool picking the freshest-headroom account, while --profile pins strictly and never rotates silently. Every run writes file artifacts (events.jsonl, patch.diff, run_facts.yaml, etc.) under ~/.claudexor/v3/projects/<project-sha256>/runs/<run_id>/; apply --dry-run validates with git apply --check, and protected paths plus human approval gates are configured in versioned .claudexor/config.yaml.
- A developer holding several Claude or Codex subscriptions who wants automatic switching to the account with headroom when 5-hour/7-day quota windows exhaust, instead of manual account swaps.
- An engineering team racing the same task across Codex and Claude (best-of-N), scored by a cross-family review panel, with the winning patch auto-adopted.
- A tech lead needing read-only deep repo research (
ask --deep-scan) or plans drafted in parallel across harnesses and merged into one (plan --council). - A remote developer running threads on a Linux server over SSH while keeping the UI local on macOS.
- An integrator embedding Claudexor as the delegated execution layer inside another agent host (like Ouroboros) or driving it via MCP/ACP/plugins for Cursor, Claude Code, Codex, OpenCode, and Copilot.
- A privacy-sensitive user who wants all cost and quota evidence auditable, no telemetry, and data kept entirely on-machine.
How do you install or deploy this agent?
Prerequisites: Node.js >= 20.19, pnpm (via corepack enable pnpm), Git, and at least one logged-in vendor CLI (codex, claude, cursor-agent, opencode, agy) or a provider API key. CLI: npm install -g claudexor, then run claudexor doctor. macOS desktop app: download the signed, notarized Claudexor-<version>.dmg from GitHub Releases and drag Claudexor.app into Applications — the app bundles its own daemon runtime. From source: pnpm install --frozen-lockfile && pnpm build, then run the CLI via node packages/cli/dist/cli.js. Always log in through claudexor auth login <harness>, not the bare vendor CLI.
How do you use this agent?
Start with claudexor doctor to confirm harness readiness; claudexor auth login claude (or codex/cursor) for each vendor; register a second account with claudexor profiles add claude work && claudexor profiles login claude work. Daily use: claudexor ask "2+2?" for read-only Q&A; claudexor ask --deep-scan "map this repo's auth" for research; claudexor plan "design a config-to-gates implementation" (add --council for parallel drafts); claudexor agent "fix the failing auth refresh test" --harness codex for write work; claudexor best-of "fix add()" --harness codex,claude --n 2 for races; claudexor apply <run_id> --dry-run to verify a patch before applying; bare claudexor opens a REPL thread where /harness and /profile switch lanes. Set budgets with --max-usd and web context with --web off|auto|cached|live.
What are this agent's strengths and limitations?
- Quota-aware multi-account pool rotation is a layer vendors don't ship: live tracking of Antigravity/Claude/Codex subscription quotas with automatic rotation only on typed vendor-limit signals — never on ordinary network errors, never off an explicit pin.
- Best-of-N races come with cross-family independent review and arbitration; a clean verified pass requires at least two distinct provider families, reducing single-model blind spots.
- Strict typed-fact model: unknown cost is never $0 (runs can end
cost_unverifiable), patches are checked withgit apply --checkbefore apply, protected paths gate on human decisions, and file artifacts are the source of truth with zero telemetry. - Thread continuity: read-only turns resume the vendor's native session (codex
exec resume, claude--resume), and lane switches inject a bounded continuation packet disclosed per turn via a typedsession.continuityevent.
- Heavy runtime dependencies: Node.js >= 20.19, pnpm, Git, and at least one logged-in vendor CLI; the desktop app is macOS-only, Linux supports only CLI/daemon, and Windows is not fully supported (the local harness installer is typed-unsupported there in this release).
- Live subscription-quota tracking and auto-rotation only cover harnesses with a vendor usage source (Antigravity, Claude, Codex); Cursor has none yet and is refused before start when it cannot guarantee
--web off. - High learning and migration cost: v2 was a clean breaking reset that imports no v1 state, and many retired modes/verbs (audit, orchestrate, etc.) hard-error rather than aliasing, so the command surface must be relearned.
- It is an orchestrator, not a substitute for subscriptions — you must hold Claude/Codex/Cursor etc. subscriptions or API keys yourself, and cross-account rotation only triggers on typed limit signals.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Claudexor This agent | 76 · Good | CLIFree + model costs | ★ 518 | 1d ago | TypeScript | Codex · Claude Code |
| Synara | 52 · Major gaps | Desktop appFree + model costs | ★ 2.1k | 1d ago | TypeScript | Codex · Claude Code |
| Oh My OpenAgent | 49 · Major gaps | Agent plugin / skillFree + model costs | ★ 70k | today | TypeScript | Claude Code |
| multi | 41 · Major gaps | — | ★ 23 | 2d ago | Shell | Codex · Claude Code · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Least privilege: scoped HOME, MCP belt with no apply tool, and nesting caps are documented, but SECURITY.md admits trusted `full` can reach out-of-project paths with no OS sandbox boundary — deduct 1. User confirmation: protected-path human gates, apply --dry-run, disclosed-and-confirmed install recipes, one-way worktree isolation earn 3. Data flow transparency: typed continuity events, loopback-only API, no-telemetry posture, and itemized outbound traffic earn 3. Sensitive data: 0600 store and redaction claims are specific but asserted without implementation code in evidence — deduct 1. Dependency security: SHA-pinned CI actions, frozen lockfile, exact npm pins, recorded installer SHA-256; no dependency vulnerability scanning visible — deduct 1. External effects: out-of-patch-capture effects of `full` are disclosed, not contained — deduct 1. Rollback: fail-closed signed-manifest updates with automatic last-known-good rollback and timestamped SSH-config backups earn 3. Source attribution: prior art credited (Praxis Relay, CLIProxyAPI), but publisher is unverified and maintainer is an individual — 1.
Self-consistency: mode/flag/retired-ID contracts align across README, SECURITY.md, and CI gates (docs-truth-check), but many README assertions cannot be cross-checked within the provided files — deduct 1. Dependency availability: doctor reports harness availability, engines pinned, multi-Node/multi-OS CI matrix — 2 (third-party CLI behavior not statically provable). Failure messages: unknown flags and retired modes hard-error with exit 2, doctor -- must be honest or CI fails, typed-failure contracts throughout — 3.
Audience: clearly targets multi-subscription power users and embedding hosts (Ouroboros), but primarily expert users — deduct 1. Capability boundaries: Cursor quota gap, Windows typed-unsupported installer, explicit in/out-of-scope earn 3. Trigger precision: strict mode-ID validation, retired IDs hard-error, flag coupling rules — 2 (contracts precise but high complexity enlarges misuse surface). Environment fit: macOS/Linux/Windows CI, SSH remote, npm and source paths documented, though remote/embedded claims carry many conditional caveats — deduct 1.
Information architecture: well-structured README TOC, dedicated SECURITY.md, referenced docs — 3. Install notes: npm/DMG/source routes with prerequisites and legacy-DMG handling — 3. Naming stability: retired verbs hard-error rather than alias, but heavy renames across v3 — deduct 1. Examples/FAQ: rich quickstart and concrete panel-JSON examples, no FAQ, examples unverified by execution — deduct 1. Known limitations: Cursor quota absence, `full` boundary, release exceptions candidly listed — 3. License: MIT, consistent across LICENSE and package. — 3. Versioning/changelog: v3.10.1, changesets, elaborate update mechanism, but no CHANGELOG file in evidence — deduct 1. Maintenance: SECURITY.md gives response expectations and support policy, but individual maintainer with no stated sustainability — deduct 1.
Output usability: typed receipts, dry-run, inspect/follow, file-backed artifacts — well specified but not executable-verified — deduct 1. Marginal value: quota rotation, best-of-N cross-family review, honest budget accounting (unknown cost is never $0) are concrete increments vendors don't ship — 3. Cost benefit: shared budget authority and exact pins reduce waste, but high product complexity imposes real learning/operational cost — deduct 1.
Claim traceability: INV numbering, docs-truth-check, INV→verify gates show a traceability apparatus — 2 (present in files but not item-verifiable here). Cross-source corroboration: README, SECURITY.md, and CI mutually support secret scanning, no-telemetry, rollback, but download badges, tests, and audits cannot be independently confirmed from static files and no third-party verification exists — deduct 2. Fact/inference separation: unknown-cost honesty, explicitly-unverified inputs, typed failure disclosure are good conventions — deduct 1 because execution claims (E2E, canary) cannot be separated from assertion at this review depth.
- Publisher is unverified: installing grants the tool power to drive paid vendor credentials and mutate repositories — review install and login paths in an isolated environment first.
- Processes under trusted `full` can read/write outside the project, and those effects are outside patch capture/review/rollback custody — avoid `full` on high-value repos.
- Sensitive-data protections (0600 store, log redaction) are documentation claims not verified by this static review.
- No evidence of dependency vulnerability scanning; run npm/pnpm audit yourself and keep the lockfile current.
- Cursor has no quota source, so rotation and budget accounting may be inaccurate on the Cursor path.
- Updates rely on a signed manifest with an offline key; v3.8.0/v3.9.0/v3.9.7 are signature-waived releases with restricted upgrade paths — note this before adopting.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v4.7.0 Claudexor 4.7.0
Release notes excerpt
Claudexor 4.7.0 (2026-10-22): Native workspace-write runs can use exact caller-created external download-cache and verification-scratch directories through execution.auxiliaryWritableRoots (CLI --auxiliary-writable-root). The negotiated accessControl.auxiliaryWritableRoots capability currently identifies Codex support; unsupported explicit selections refuse, while Auto filters incompatible lanes before profile checks. Admission rejects overlap with source/execution trees and protected engine/profile state, including macOS directory aliases. Grants apply per native turn without changing …View on GitHub ↗ -
v4.6.2 Claudexor 4.6.2
Release notes excerpt
Claudexor 4.6.2 (2026-10-22): The first published release of the 4.6 line on GitHub. v4.6.1 reached npm, but #485 reached main while its publish ran, so its GitHub Release was refused; everything listed under v4.6.1 and v4.6.0 ships here. Also new: local macOS app bundles are ad-hoc signed and strictly verified before a ZIP or DMG is made (#485). Thanks to @IlidanNaga for #485. Signed, notarized, stapled, SBOM-backed and provenance-attested.View on GitHub ↗ -
v4.5.0 Claudexor 4.5.0
Release notes excerpt
Claudexor 4.5.0 (2026-10-21): An account that cannot serve a requested Codex model no longer absorbs every request for that model. Auto model operations prefer accounts whose live catalog lists the model. A recognized pre-generation refusal (model_capability_refused: an explicit model-not-found or not-supported code, the ChatGPT-account unsupported-model sentence, the narrow missing-model sentences) gives that account a temporary capability mark for that model (four hours, then one probe; cleared by service there or by a catalog or credential change). Any other definite provider HTTP 4xx be …View on GitHub ↗